Radiology Departments at Higher Risk for Ransomware Attacks
On July 16, 2026, the CHAOS ransomware group posted a claim on Tor alleging it had compromised Radia Inc., P.S., one of the largest physician-owned radiology groups in the United States, serving over 50 clinics across Washington and Idaho [3][4]. The group claimed to have exfiltrated 655 gigabytes of data spanning patient records, corporate financials, legal documents, and employee information [3]. As of August 1, 2026, Radia had not confirmed the breach or filed reports with state attorneys general [4]. A class-action investigation is already underway [4].
This is not an isolated event. In the same reporting period, Women's Center for Radiology in Orlando, Florida, notified patients of unauthorized network access discovered around April 28, 2026 [2]. Northwest Radiologists and Mount Baker Imaging in Bellingham, Washington, agreed to a $3.3 million settlement consolidating four lawsuits from a January 2025 ransomware attack that exposed data belonging to an estimated 350,000 patients [1]. According to BlackFog, healthcare was among the most heavily targeted sectors for publicly disclosed ransomware attacks in July 2026 [2].
Healthcare Ransomware Activity: The Current State
The FBI reported that healthcare organizations were the most targeted critical infrastructure sector for ransomware in 2025 [7][16]. In the European Union, ENISA documented at least 289 cybersecurity incidents affecting healthcare providers in 2024, more than any other essential sector, and ransomware was responsible for an estimated 71% of those incidents that disrupted patient care [16].
Sophos surveyed healthcare IT and cybersecurity leaders and found notable tactical shifts. Data encryption in healthcare ransomware incidents fell to 34% in 2025 from 74% in 2024, a five-year low[14][15]. Extortion-only attacks (data stolen but not encrypted) tripled to 12% of healthcare cases[14]. Only 36% of healthcare providers paid a ransom, down from 61% in 2022[15]. According to reporting on the Sophos survey, median ransom demands dropped significantly to roughly $345,000 [15]. Recovery times improved: 58% of healthcare organizations recovered within a week, up from 21% reported in 2024[15].
These figures suggest healthcare organizations are getting better at resisting encryption and refusing payment. Ransomware operators are adapting accordingly, pivoting toward pure data extortion. The sensitivity of medical records, including imaging data, makes this model viable even without deploying an encryptor.
Why Radiology Departments Carry Concentrated Risk
Po-Hao Chen, MD, security committee chair of the Society for Imaging Informatics in Medicine (SIIM), stated at the SIIM 2026 annual meeting that attacks on hospital radiology departments have increased exponentially since 2000, a timeline that correlates with the shift to all-digital radiology operations [7]. No published data exists on successful attacks against hospital radiology departments specifically, Chen noted, but available data suggests an upward trend [7].
Three structural factors explain the concentration of risk.
Data density. Radiology practices generate and store terabytes of imaging data linked to protected health information. The CHAOS group's claim against Radia Inc. illustrates the scope: 655 gigabytes allegedly containing patient full names, Social Security numbers, medical record numbers, diagnostic imaging reports, patient history questionnaires, and full medical billing records [3]. Corporate financials, legal documents, and HR records were also claimed [3].
Device and system sprawl. Modern radiology depends on a highly connected digital ecosystem. Data moves continuously between electronic health records, radiology information systems, PACS platforms, scanners, AI inference engines, workstations, reporting tools, and third-party cloud applications [7][16]. Each integration point is a potential entry vector. Clinical imaging systems can legitimately produce file-operation bursts, complicating detection of ransomware behavior [20].
Legacy infrastructure and staffing gaps. CT and MRI scanners frequently run embedded operating systems that vendors no longer patch. US Radiology Specialists paid $450,000 in penalties to New York State after an investigation found the company had not prioritized upgrading hardware, leaving its network exposed to a known vulnerability that enabled a ransomware attack affecting over 92,000 New Yorkers [17]. Sophos found that 42% of healthcare ransomware victims cited lack of personnel or capacity as the top organizational cause of their breach[14].
CHAOS
CHAOS is a Ransomware-as-a-Service group first observed in early 2025, distinct from the older Chaos Ransomware Builder that originated around 2021 [6]. The group targets organizations across Windows, ESXi, Linux, and NAS platforms using double-extortion tactics with configurable encryption and optional partial-file targeting for stealth [6]. Initial access comes through vulnerabilities, phishing, or brokered credentials [6]. Beyond the Radia Inc. claim, notable CHAOS incidents include the breach of Optima Tax Relief, where the group exfiltrated 69 GB of data before encrypting systems [6].
Medusa
CISA, the FBI, and HHS have issued a joint advisory on Medusa ransomware (AA25-071A). The advisory documents more than 300 compromised organizations across critical infrastructure sectors as of February 2025, and according to secondary reporting, the advisory was updated in August 2026 to reflect more than 500 victims[13]. Medusa, a RaaS variant first identified in June 2021, uses a double-extortion model combining encryption with threatened data publication. Impacted sectors include medical, education, legal, insurance, technology, and manufacturing.
Gunra
CISA, FBI, and partner agencies released a joint #StopRansomware advisory on Gunra, a RaaS variant reported to be derived from leaked Conti source code. Gunra actors gain initial access by exploiting CVE-2024-55591 and CVE-2025-24472 in internet-facing Fortinet FortiOS and FortiProxy devices. Targeted sectors include healthcare and public health, financial services, government, and professional services.
Qilin
Qilin (originally Agenda) has been active since at least 2022, operating as a RaaS with variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments [10]. The group shares functionality overlaps with Black Basta, REvil, and BlackCat [10]. The June 2024 attack on Synnovis, an NHS pathology services provider, reportedly halted approximately 90% of blood testing capacity and forced over 1,100 surgeries and 2,000 outpatient appointments to be canceled within two weeks [9]. Qilin affiliates use spearphishing, exploitation of public-facing applications (Citrix, RDP, VPNs), and compromised credentials from infostealer malware for initial access [11].
Operational Impact on Imaging Departments
A Dutch-led international study presented at the European Congress of Radiology (ECR) 2026 found that ransomware attacks significantly affect emergency radiology workflow, acute care delivery, and staff well-being.
During the 2021 Irish Health Service Executive ransomware attack, decryption took a week to begin. Junior radiologists were sent to consumer electronics stores to buy external hard drives. Departments reverted to carbon paper and handwritten triplicate reports. A hospital near Paris experienced a ransomware attack that continued to severely impact all departments' IT systems and web access, with imaging particularly affected.
The Boston Scientific incident in August 2026, detected on August 25 and disclosed via SEC Form 8-K on August 26, caused a widespread network outage that halted global customer order processing and distribution [18]. According to reporting by ShieldWorkz, BSX stock fell approximately 3.5% in premarket trading [18]. No threat actor had publicly claimed responsibility as of August 31, 2026 [18]. According to ShieldWorkz analysis, the attack pattern appears consistent with a double-extortion ransomware intrusion [18]. Although Boston Scientific is a medical device manufacturer rather than a radiology practice, downstream supply chain disruption to hospitals relying on just-in-time deliveries of critical devices is a direct operational concern [18].
IOC Table
| Type | Value | Context | Source |
|---|---|---|---|
| Malware | CHAOS | RaaS group, claimed Radia Inc. breach, July 2026 | [3][4][6] |
| Malware | Medusa | RaaS, 300-500+ victims, healthcare focus, CISA advisory AA25-071A | [13] |
| Malware | Gunra | RaaS, CISA advisory Aug 2026 | |
| Malware | Qilin | RaaS active since 2022, NHS Synnovis attack | [9][10] |
| CVE | CVE-2024-55591 | Fortinet FortiOS/FortiProxy authentication bypass, CVSS 9.8, exploited by Gunra | |
| CVE | CVE-2025-24472 | Fortinet FortiOS/FortiProxy CSF proxy authentication bypass, exploited by Gunra |
MITRE ATT&CK Mapping
The following techniques are directly supported by the source material for the threat groups discussed:
| ID | Technique | Relevance |
|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | Medusa, Qilin, CHAOS initial access [6][11] |
| T1566.002 | Phishing: Spearphishing Link | Medusa phishing for credential theft |
| T1190 | Exploit Public-Facing Application | Gunra (CVE-2024-55591, CVE-2025-24472); Qilin (Citrix, VPN) [11] |
| T1078 | Valid Accounts | Brokered/stolen credentials for initial access [6][11] |
| T1059.001 | PowerShell | Medusa obfuscation techniques; healthcare intrusion chains [21] |
| T1059.003 | Windows Command Shell | Living-off-the-land execution [21] |
| T1021.001 | Remote Services: RDP | Lateral movement in healthcare networks [11][21] |
| T1486 | Data Encrypted for Impact | Core ransomware function across all groups [6][9] |
| T1490 | Inhibit System Recovery | Shadow copy deletion prior to encryption [9] |
| T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Double-extortion data theft [3] |
| T1548.002 | Abuse Elevation Control Mechanism: Bypass UAC | Qilin privilege escalation [10] |
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential harvesting during lateral movement [10] |
| T1489 | Service Stop | Stopping security and backup services pre-encryption [9] |
Detection and Hunting
Ransom note file creation. Monitor for creation of files matching known ransom note patterns. The following Sigma rule targets common naming conventions:
title: Ransom Note File Creation in Healthcare Environment
status: experimental
author: RedSheepSec
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains:
- 'HOW_TO_DECRYPT'
- 'RECOVER_FILES'
- 'RESTORE_YOUR_FILES'
- 'DECRYPT_INSTRUCTION'
- 'README_FOR_DECRYPT'
condition: selection
level: criticalPsExec and living-off-the-land lateral movement. Ransomware operators in healthcare consistently use PsExec, WMI, PowerShell, and RDP for lateral movement rather than custom malware [21]. Hunt for PsExec execution from non-standard paths, WMI process creation spawning cmd.exe or powershell.exe on remote hosts, and RDP sessions originating from unexpected internal sources.
PACS and imaging system baselines. Clinical imaging systems legitimately produce file-operation bursts that can trigger false positives for mass file-rename detection rules [20]. Establish baselines for normal DICOM file I/O patterns on PACS servers and set alert thresholds above those baselines.
Unpatched internet-facing appliances. Gunra's documented initial access vector exploits CVE-2024-55591 and CVE-2025-24472 in Fortinet FortiOS and FortiProxy devices. Exploited vulnerabilities were the top technical cause of healthcare ransomware in 2025, accounting for 33% of incidents[14]. Scan for these CVEs and prioritize patching VPN concentrators, firewalls, and remote access gateways.
Extortion-only detection. With encryption rates falling and extortion-only attacks tripling[14], organizations that focus detection exclusively on encryption events will miss a growing share of intrusions. Monitor for bulk file access, staging of archive files (ZIP, 7z, RAR) in unusual directories, and large outbound data transfers to uncommon destinations.
Analysis
The ransomware threat to radiology is not diminishing. It is shifting form. The drop in encryption rates and ransom payments reported by Sophos[14][15] does not mean healthcare organizations are safe. It means attackers have learned that stealing radiology data, with its dense mix of PII, PHI, and imaging records, can generate sufficient extortion pressure without the operational noise of deploying an encryptor.
The CHAOS claim against Radia Inc. is a case study in this model. The group published a sample of stolen data and threatened to release the rest unless negotiations proceeded [5]. The claimed dataset (655 GB) spans patient records, billing, legal documents, and HR files [3]. For a radiology group serving 50+ clinics, a verified breach of that scope would trigger HIPAA notification obligations, state attorney general investigations, and class-action litigation, as the Northwest Radiologists settlement demonstrates [1][4].
The joint ACR/SIIM cybersecurity guidelines published in 2025 represent the first comprehensive, imaging-specific security framework from the profession's own leadership [7][8]. The guidelines address the imaging pipeline, frontline caregiver training, and incident response planning [8]. Their publication signals recognition within radiology that the profession's digital dependency has outpaced its security posture.
The August 2026 Boston Scientific incident adds a supply-chain dimension [18]. Hospitals relying on just-in-time delivery of implantable devices face downstream disruption when a manufacturer's order processing and distribution systems go offline. Radiology departments that depend on vendor-managed equipment, cloud-hosted AI inference, or third-party PACS hosting carry analogous supply-chain exposure.
Red Sheep Assessment
Confidence: Moderate
The sources collectively point to a structural mismatch between the value of radiology data and the security resources available to protect it. Radiology practices, particularly physician-owned groups and outpatient imaging centers, operate with thin IT staffing and legacy device inventories. They generate and store data that is among the most valuable in healthcare for extortion purposes: dense PII/PHI, diagnostic imaging, and billing records.
We assess that the shift toward extortion-only attacks is likely to accelerate targeting of radiology specifically. An attacker who can exfiltrate a radiology group's data without encrypting anything avoids the operational disruption that triggers rapid incident response. The breach may not be discovered until the extortion demand arrives or data appears on a leak site. Radia Inc. had not confirmed its breach or filed regulatory notifications as of August 1, 2026, despite the CHAOS group's July 16 posting [4].
A contrarian reading is that the Sophos data showing declining ransom payments and faster recovery could indicate the healthcare sector is genuinely hardening. The ACR/SIIM guidelines, the CISA CI Fortify initiative [19], and the updated Medusa and Gunra advisories represent coordinated defensive momentum. The question is whether that momentum reaches the small and mid-sized radiology practices that lack enterprise security teams. According to secondary reporting, Medusa's victim profile skews toward organizations that lack enterprise security teams [13]. The same is likely true for many radiology groups.
Defender's Checklist
- ▢[ ] Audit all internet-facing Fortinet FortiOS and FortiProxy appliances for CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472. Apply FortiOS patches per Fortinet PSIRT advisory FG-IR-24-535. Gunra actively exploits both.
- ▢[ ] Implement monitoring for bulk file access and large outbound transfers from PACS servers, RIS, and EHR-connected imaging shares. Extortion-only attacks will not trigger encryption-based alerts[14][20].
- ▢[ ] Review and apply the ACR/SIIM joint cybersecurity white paper (2025, DOI: 10.1007/s10278-025-01621-4) for imaging-specific hardening, incident response, and vendor management guidance [7][8].
- ▢[ ] Enforce phishing-resistant MFA (FIDO2/WebAuthn) on all VPN and remote access accounts. Confirm backup integrity and test offline restoration procedures for PACS and RIS systems[15].
- ▢[ ] Baseline normal file I/O patterns on PACS servers and DICOM storage to establish reliable detection thresholds for mass file-rename or mass file-access anomalies [20].
References
[1] https://radiologybusiness.com/topics/healthcare-management/legal-news/radiology-practice-agrees-3m-settlement-class-action-lawsuit-over-cyberattack
[2] https://www.blackfog.com/the-state-of-ransomware-2026/
[3] https://www.claimdepot.com/data-breach/radia-2026
[4] https://www.classactionlawyers.com/blog/radia
[5] https://www.dexpose.io/chaos-ransomware-group-strikes-radia-inc/
[6] https://www.ransomlook.io/group/chaos
[7] https://healthcare-in-europe.com/en/news/radiology-ransomware-cyberattack.html
[8] https://link.springer.com/article/10.1007/s10278-025-01621-4
[9] https://www.blackfog.com/qilin-ransomware-analysis-impact-and-defense-2025/
[10] https://attack.mitre.org/software/S1242/
[11] https://www.rescana.com/post/qilin-ransomware-attack-analysis-technical-assessment-of-q-link-wireless-incident-and-sector-specific-mitigation-strateg
[12] https://blog.qualys.com/vulnerabilities-threat-research/2025/06/18/qilin-ransomware-explained-threats-risks-defenses
[13] https://www.cyberfenceplatform.com/blog/medusa-ransomware-2026
[14] https://hitconsultant.net/2025/11/21/ransomware-state-of-healthcare-2025/
[15] https://cxotoday.com/media-coverage/sophoss-state-of-ransomware-in-healthcare-2025-report-reveals-58-of-providers-now-recover-within-a-week-amid-declining-ransom-payments-across-the-sector/
[16] https://quomi.com/radiology/radiology-vs-ransomware-how-to-defend-imaging-departments-against-cyberattacks
[17] https://ag.ny.gov/press-release/2023/attorney-general-james-secures-450000-medical-company-providing-services-western
[18] https://shieldworkz.com/blogs/deep-dive-into-the-boston-scientific-cyberattack
[19] https://www.paubox.com/blog/cisa-warns-healthcare-should-prepare-for-disruptive-cyberattacks
[20] https://securityarsenal.com/blog/ransomware-breaches-at-five-us-healthcare-providers-detection-and-hardening-guide-for-defenders
[21] https://cybelangel.com/blog/ransomware-in-healthcare-attack-timeline/